For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) meeting NIST password guidelines and TOTP MFA should be more than enough.
SOC 2 Type 2 does not have specific technical requirements. What you have to do is to satisfy your assessor.
And if your company cannot satisfy your assessor, then there is a mechanism called "management response" where the company gets to explain away the findings from the assessor.
And if your assessor is 4 years behind in their understanding of best practices in this area, then perhaps you need to find a new assessor ...